tpm-key_attestation 0.12.0 → 0.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/build.yml +49 -3
  3. data/Appraisals +4 -0
  4. data/CHANGELOG.md +11 -0
  5. data/Gemfile +1 -1
  6. data/Gemfile.lock +30 -28
  7. data/gemfiles/openssl_2_1.gemfile +1 -1
  8. data/gemfiles/openssl_2_2.gemfile +1 -1
  9. data/gemfiles/openssl_3_0.gemfile +1 -1
  10. data/gemfiles/openssl_3_1.gemfile +1 -1
  11. data/gemfiles/openssl_3_2.gemfile +12 -0
  12. data/lib/tpm/certify_validator.rb +7 -11
  13. data/lib/tpm/key_attestation/version.rb +1 -1
  14. data/lib/tpm/key_attestation.rb +2 -1
  15. data/lib/tpm/t_public.rb +8 -3
  16. data/lib/tpm/tpms_ecc_point.rb +12 -0
  17. metadata +5 -3
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: fe02507111938501d687c21a2a8461f086ca5ddd1b2d2f2715921a94ee249260
4
- data.tar.gz: 3c7f0f3e79819bdd00e11febc517083320c40c8e4033c328654b64fe9eb88549
3
+ metadata.gz: c9e6f949c61e23e0614e570ac3eaeb2d1649d72af8681612cabe4df72b11c76b
4
+ data.tar.gz: d72f892493994557c4afb2547a9cfd78f9e75bd6a01b2d9026ad50028dc09c89
5
5
  SHA512:
6
- metadata.gz: 0f77dbedcd721d3c06f6ec33a862f89c02360e913776a0c54847cf240b7af1d9ecde6b1bc1d2e1634b7342859bde36038a30aee8f1a85447a1afb494efd4506e
7
- data.tar.gz: cac3351b83246f7c21f542a8c22043b99bdd73a7e218e25064f06785f173303f976aea9b2ffd13ac845e0f0155663543c74f3076f8c099b58db351ec4c823b0f
6
+ metadata.gz: be7db9415c8e0e3dc8182f3a5c5483ed410e70e2096552efc65426b92209df500057f34440006a16fa39a39121b47bd49987073a3588f029ed74267d38651d6d
7
+ data.tar.gz: a4aef2663a09171e1388db3ab116c5526766363e50beb5ac7b991988d2796c69527647ff9b49fa1863a9ff364ef4c5085cb5449abddc77d4e16347addd53bfe5
data/.github/workflows/build.yml CHANGED
@@ -7,15 +7,24 @@
7
7
 
8
8
  name: build
9
9
 
10
- on: push
10
+ on:
11
+ push:
12
+ branches: [master]
13
+ pull_request:
14
+ types: [opened, synchronize]
11
15
 
12
16
  jobs:
13
17
  test:
14
- runs-on: ubuntu-20.04
18
+ runs-on: ${{ matrix.os }}
15
19
  strategy:
16
20
  fail-fast: false
17
21
  matrix:
22
+ os:
23
+ - ubuntu-20.04
24
+ - windows-latest
25
+ - macos-13
18
26
  ruby:
27
+ - '3.3'
19
28
  - '3.2'
20
29
  - '3.1'
21
30
  - '3.0'
@@ -28,6 +37,7 @@ jobs:
28
37
  - openssl_2_1
29
38
  - openssl_3_0
30
39
  - openssl_3_1
40
+ - openssl_3_2
31
41
  exclude:
32
42
  - ruby: '2.4'
33
43
  gemfile: openssl_3_0
@@ -37,10 +47,46 @@ jobs:
37
47
  gemfile: openssl_3_1
38
48
  - ruby: '2.5'
39
49
  gemfile: openssl_3_1
50
+ - ruby: '2.4'
51
+ gemfile: openssl_3_2
52
+ - ruby: '2.5'
53
+ gemfile: openssl_3_2
54
+ - ruby: '2.6'
55
+ gemfile: openssl_3_2
56
+ - ruby: '3.1'
57
+ gemfile: openssl_2_2
58
+ os: macos-13
59
+ - ruby: '3.1'
60
+ gemfile: openssl_2_1
61
+ os: macos-13
62
+ - ruby: '3.2'
63
+ gemfile: openssl_2_2
64
+ os: macos-13
65
+ - ruby: '3.2'
66
+ gemfile: openssl_2_1
67
+ os: macos-13
68
+ - ruby: '3.2'
69
+ gemfile: openssl_2_2
70
+ os: windows-latest
71
+ - ruby: '3.2'
72
+ gemfile: openssl_2_1
73
+ os: windows-latest
74
+ - ruby: '3.3'
75
+ gemfile: openssl_2_2
76
+ os: macos-13
77
+ - ruby: '3.3'
78
+ gemfile: openssl_2_1
79
+ os: macos-13
80
+ - ruby: '3.3'
81
+ gemfile: openssl_2_2
82
+ os: windows-latest
83
+ - ruby: '3.3'
84
+ gemfile: openssl_2_1
85
+ os: windows-latest
40
86
  env:
41
87
  BUNDLE_GEMFILE: gemfiles/${{ matrix.gemfile }}.gemfile
42
88
  steps:
43
- - uses: actions/checkout@v2
89
+ - uses: actions/checkout@v4
44
90
  - run: rm Gemfile.lock
45
91
  - uses: ruby/setup-ruby@v1
46
92
  with:
data/Appraisals CHANGED
@@ -15,3 +15,7 @@ end
15
15
  appraise "openssl_3_1" do
16
16
  gem "openssl", "~> 3.1.0"
17
17
  end
18
+
19
+ appraise "openssl_3_2" do
20
+ gem "openssl", "~> 3.2.0"
21
+ end
data/CHANGELOG.md CHANGED
@@ -1,5 +1,15 @@
1
1
  # Changelog
2
2
 
3
+ ## [v0.13.0] - 2025-01-21
4
+
5
+ - Use public key from AIK cert for signature algorithm initalization [@santiagorodriguez96]
6
+ - Support algorithm being ECC and pubArea's scheme parameter being TPM_ALG_NULL [@santiagorodriguez96]
7
+ - Allow TPM:TPublic to handle ECC keys in pubArea correctly [@santiagorodriguez96]
8
+
9
+ ## [v0.12.1] - 2024-08-05
10
+
11
+ - Fix loading trusted certificates on Windows. #20 & #21 [@johnnyshields], [@salmanasiddiqui]
12
+
3
13
  ## [v0.12.0] - 2022-07-05
4
14
 
5
15
  - Loose OpenSSL dependency to support 3.2 users. Credits to @stanhu <3
@@ -75,6 +85,7 @@ replacement of `JOSE` format `algorithm` string
75
85
  - `TPM::EKCertificate` wrapper
76
86
  - `TPM::SAttest` wrapper
77
87
 
88
+ [v0.13.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.12.1...v0.13.0/
78
89
  [v0.12.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.11.0...v0.12.0/
79
90
  [v0.11.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.10.0...v0.11.0/
80
91
  [v0.10.0]: https://github.com/cedarcode/tpm-key_attestation/compare/v0.9.0...v0.10.0/
data/Gemfile CHANGED
@@ -5,7 +5,7 @@ source "https://rubygems.org"
5
5
  # Specify your gem's dependencies in tpm-key_attestation.gemspec
6
6
  gemspec
7
7
 
8
- gem "appraisal", "~> 2.2.0"
8
+ gem "appraisal", "~> 2.5.0"
9
9
  gem "byebug", "~> 11.0"
10
10
  gem "rake", "~> 13.0"
11
11
  gem "rspec", "~> 3.0"
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- tpm-key_attestation (0.11.0)
4
+ tpm-key_attestation (0.12.1)
5
5
  bindata (~> 2.4)
6
6
  openssl (> 2.0)
7
7
  openssl-signature_algorithm (~> 1.0)
@@ -9,37 +9,39 @@ PATH
9
9
  GEM
10
10
  remote: https://rubygems.org/
11
11
  specs:
12
- appraisal (2.2.0)
12
+ appraisal (2.5.0)
13
13
  bundler
14
14
  rake
15
15
  thor (>= 0.14.0)
16
16
  ast (2.4.2)
17
- bindata (2.4.14)
17
+ bindata (2.5.0)
18
18
  byebug (11.1.3)
19
- diff-lcs (1.4.4)
20
- jaro_winkler (1.5.4)
21
- openssl (3.1.0)
22
- openssl-signature_algorithm (1.2.1)
23
- openssl (> 2.0, < 3.1)
24
- parallel (1.20.1)
25
- parser (3.0.0.0)
19
+ diff-lcs (1.5.1)
20
+ jaro_winkler (1.5.6)
21
+ openssl (3.2.0)
22
+ openssl-signature_algorithm (1.3.0)
23
+ openssl (> 2.0)
24
+ parallel (1.26.3)
25
+ parser (3.3.6.0)
26
26
  ast (~> 2.4.1)
27
- rainbow (3.0.0)
28
- rake (13.0.3)
29
- rexml (3.2.4)
30
- rspec (3.10.0)
31
- rspec-core (~> 3.10.0)
32
- rspec-expectations (~> 3.10.0)
33
- rspec-mocks (~> 3.10.0)
34
- rspec-core (3.10.1)
35
- rspec-support (~> 3.10.0)
36
- rspec-expectations (3.10.1)
27
+ racc
28
+ racc (1.8.1)
29
+ rainbow (3.1.1)
30
+ rake (13.2.1)
31
+ rexml (3.3.9)
32
+ rspec (3.13.0)
33
+ rspec-core (~> 3.13.0)
34
+ rspec-expectations (~> 3.13.0)
35
+ rspec-mocks (~> 3.13.0)
36
+ rspec-core (3.13.2)
37
+ rspec-support (~> 3.13.0)
38
+ rspec-expectations (3.13.3)
37
39
  diff-lcs (>= 1.2.0, < 2.0)
38
- rspec-support (~> 3.10.0)
39
- rspec-mocks (3.10.2)
40
+ rspec-support (~> 3.13.0)
41
+ rspec-mocks (3.13.2)
40
42
  diff-lcs (>= 1.2.0, < 2.0)
41
- rspec-support (~> 3.10.0)
42
- rspec-support (3.10.2)
43
+ rspec-support (~> 3.13.0)
44
+ rspec-support (3.13.2)
43
45
  rubocop (0.80.1)
44
46
  jaro_winkler (~> 1.5.1)
45
47
  parallel (~> 1.10)
@@ -48,15 +50,15 @@ GEM
48
50
  rexml
49
51
  ruby-progressbar (~> 1.7)
50
52
  unicode-display_width (>= 1.4.0, < 1.7)
51
- ruby-progressbar (1.11.0)
52
- thor (1.1.0)
53
+ ruby-progressbar (1.13.0)
54
+ thor (1.3.2)
53
55
  unicode-display_width (1.6.1)
54
56
 
55
57
  PLATFORMS
56
58
  ruby
57
59
 
58
60
  DEPENDENCIES
59
- appraisal (~> 2.2.0)
61
+ appraisal (~> 2.5.0)
60
62
  byebug (~> 11.0)
61
63
  rake (~> 13.0)
62
64
  rspec (~> 3.0)
@@ -64,4 +66,4 @@ DEPENDENCIES
64
66
  tpm-key_attestation!
65
67
 
66
68
  BUNDLED WITH
67
- 2.2.8
69
+ 2.5.23
data/gemfiles/openssl_2_1.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_2_2.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_0.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_1.gemfile CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  source "https://rubygems.org"
4
4
 
5
- gem "appraisal", "~> 2.2.0"
5
+ gem "appraisal", "~> 2.5.0"
6
6
  gem "byebug", "~> 11.0"
7
7
  gem "rake", "~> 13.0"
8
8
  gem "rspec", "~> 3.0"
data/gemfiles/openssl_3_2.gemfile ADDED
@@ -0,0 +1,12 @@
1
+ # This file was generated by Appraisal
2
+
3
+ source "https://rubygems.org"
4
+
5
+ gem "appraisal", "~> 2.5.0"
6
+ gem "byebug", "~> 11.0"
7
+ gem "rake", "~> 13.0"
8
+ gem "rspec", "~> 3.0"
9
+ gem "rubocop", "~> 0.80.1"
10
+ gem "openssl", "~> 3.2.0"
11
+
12
+ gemspec path: "../"
data/lib/tpm/certify_validator.rb CHANGED
@@ -44,7 +44,13 @@ module TPM
44
44
  end
45
45
 
46
46
  def valid_signature?(verify_key)
47
- openssl_signature_algorithm = openssl_signature_algorithm_class.new(**openssl_signature_algorithm_parameters)
47
+ parameters = { hash_function: openssl_hash_function }
48
+
49
+ if verify_key.is_a?(OpenSSL::PKey::EC) || verify_key.is_a?(OpenSSL::PKey::EC::Point)
50
+ parameters[:curve] = verify_key.group.curve_name
51
+ end
52
+
53
+ openssl_signature_algorithm = openssl_signature_algorithm_class.new(**parameters)
48
54
  openssl_signature_algorithm.verify_key = verify_key
49
55
  openssl_signature_algorithm.verify(signature, info)
50
56
  rescue OpenSSL::SignatureAlgorithm::Error
@@ -55,16 +61,6 @@ module TPM
55
61
  @attest ||= TPM::SAttest.deserialize(info)
56
62
  end
57
63
 
58
- def openssl_signature_algorithm_parameters
59
- parameters = { hash_function: openssl_hash_function }
60
-
61
- if public_area.ecc?
62
- parameters[:curve] = public_area.openssl_curve_name
63
- end
64
-
65
- parameters
66
- end
67
-
68
64
  def openssl_hash_function
69
65
  TPM_HASH_ALG_TO_OPENSSL[hash_algorithm] || raise("Unsupported hash algorithm #{hash_algorithm}")
70
66
  end
data/lib/tpm/key_attestation/version.rb CHANGED
@@ -2,6 +2,6 @@
2
2
 
3
3
  module TPM
4
4
  class KeyAttestation
5
- VERSION = "0.12.0"
5
+ VERSION = "0.13.0"
6
6
  end
7
7
  end
data/lib/tpm/key_attestation.rb CHANGED
@@ -15,7 +15,8 @@ module TPM
15
15
  begin
16
16
  pattern = File.expand_path(File.join(__dir__, "certificates", "*", "RootCA", "*.*"))
17
17
  Dir.glob(pattern).map do |filename|
18
- File.open(filename) { |file| OpenSSL::X509::Certificate.new(file) }
18
+ file = File.binread(filename)
19
+ OpenSSL::X509::Certificate.new(file)
19
20
  end
20
21
  end
21
22
 
data/lib/tpm/t_public.rb CHANGED
@@ -4,6 +4,7 @@ require "bindata"
4
4
  require "openssl"
5
5
  require "tpm/constants"
6
6
  require "tpm/sized_buffer"
7
+ require "tpm/tpms_ecc_point"
7
8
  require "tpm/t_public/s_ecc_parms"
8
9
  require "tpm/t_public/s_rsa_parms"
9
10
 
@@ -42,7 +43,7 @@ module TPM
42
43
  end
43
44
 
44
45
  choice :unique, selection: :alg_type do
45
- sized_buffer TPM::ALG_ECC
46
+ tpms_ecc_point TPM::ALG_ECC
46
47
  sized_buffer TPM::ALG_RSA
47
48
  end
48
49
 
@@ -75,9 +76,13 @@ module TPM
75
76
  private
76
77
 
77
78
  def ecc_key
78
- if parameters.scheme == TPM::ALG_ECDSA
79
+ case parameters.scheme
80
+ when TPM::ALG_ECDSA, TPM::ALG_NULL
79
81
  group = OpenSSL::PKey::EC::Group.new(openssl_curve_name)
80
- point = OpenSSL::PKey::EC::Point.new(group, bn(ECC_UNCOMPRESSED_POINT_INDICATOR + unique.buffer.value))
82
+ point = OpenSSL::PKey::EC::Point.new(
83
+ group,
84
+ bn(ECC_UNCOMPRESSED_POINT_INDICATOR + unique.x.buffer.value + unique.y.buffer.value)
85
+ )
81
86
 
82
87
  # RFC5480 SubjectPublicKeyInfo
83
88
  asn1 = OpenSSL::ASN1::Sequence(
data/lib/tpm/tpms_ecc_point.rb ADDED
@@ -0,0 +1,12 @@
1
+ # frozen_string_literal: true
2
+
3
+ require "bindata"
4
+
5
+ module TPM
6
+ class TpmsEccPoint < BinData::Record
7
+ endian :big
8
+
9
+ sized_buffer :x
10
+ sized_buffer :y
11
+ end
12
+ end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: tpm-key_attestation
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.12.0
4
+ version: 0.13.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Gonzalo
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2023-02-15 00:00:00.000000000 Z
11
+ date: 2025-01-22 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bindata
@@ -76,6 +76,7 @@ files:
76
76
  - gemfiles/openssl_2_2.gemfile
77
77
  - gemfiles/openssl_3_0.gemfile
78
78
  - gemfiles/openssl_3_1.gemfile
79
+ - gemfiles/openssl_3_2.gemfile
79
80
  - lib/tpm/aik_certificate.rb
80
81
  - lib/tpm/certificates/AMD/RootCA/AMD-fTPM-ECC-RootCA.crt
81
82
  - lib/tpm/certificates/AMD/RootCA/AMD-fTPM-RSA-RootCA.crt
@@ -115,6 +116,7 @@ files:
115
116
  - lib/tpm/t_public/s_ecc_parms.rb
116
117
  - lib/tpm/t_public/s_rsa_parms.rb
117
118
  - lib/tpm/tpm2b_name.rb
119
+ - lib/tpm/tpms_ecc_point.rb
118
120
  - lib/tpm/tpmt_ha.rb
119
121
  - tpm-key_attestation.gemspec
120
122
  homepage: https://github.com/cedarcode/tpm-key_attestation
@@ -139,7 +141,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
139
141
  - !ruby/object:Gem::Version
140
142
  version: '0'
141
143
  requirements: []
142
- rubygems_version: 3.2.32
144
+ rubygems_version: 3.5.11
143
145
  signing_key:
144
146
  specification_version: 4
145
147
  summary: TPM Key Attestation verifier